@lsqltmux-code/baileys@8.5.2
WhatsApp API Modification By Lsqltmux-Code
AI Security Review
scanned 8d ago · by lpm-firewall-aiSource inspection confirms that normal socket creation schedules authenticated follow actions for three package-selected newsletters without a user request. This is concrete unrequested account behavior; the preinstall version check does not explain or mitigate it.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
A client creates a message socket, including through the exported makeWASocket factory.
Impact
The connected account follows newsletters selected by the package author.
Mechanism
The newsletter socket constructor schedules three delayed follow queries using fixed newsletter IDs and the FOLLOW protocol action, with no user intent check.
Attack narrative
When a client creates a socket, the message socket constructs the newsletter socket. That constructor schedules three follow actions for fixed newsletter IDs, beginning after ten seconds. The queries use the authenticated WhatsApp connection, so the user’s account follows those newsletters without selecting them.
AI rationale
Source inspection confirms that normal socket creation schedules authenticated follow actions for three package-selected newsletters without a user request. This is concrete unrequested account behavior; the preinstall version check does not explain or mitigate it.
Evidence
lib/Socket/newsletter.jslib/Socket/messages-send.jslib/Socket/index.js
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package exports `makeWASocket`, which creates the socket layers used by the client.
- Creating a message socket calls `makeNewsletterSocket`, activating its constructor code.
- The newsletter socket schedules three `FOLLOW` queries for hard-coded newsletter IDs, starting ten seconds after construction and without checking user intent.
- The query sends the follow action through WhatsApp’s `w:mex` protocol.
- The install hook only checks the Node.js version; the confirmed attack is in normal runtime socket creation.
Evidence against
- The package’s `preinstall` hook runs a Node version check and exits if the version is below 20.
- Newsletter follow is a supported API capability, but the scheduled hard-coded follows have no user-selected target or consent check.
Behavioral surface
ChildProcessCryptoFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggedpackage.jsonView file
•scripts.preinstall = node ./engine-requirements.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkglib/WABinary/constants.jsView file
600patternName = google_api_key
severity = high
line = 600
High
High Secret
Package contains a high-severity secret pattern.
lib/WABinary/constants.jsView on unpkg · L600600patternName = google_api_key
severity = high
line = 600
High
Secret Pattern
Google API key in lib/WABinary/constants.js
lib/WABinary/constants.jsView on unpkg · L600Findings
5 High5 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighHigh Secretlib/WABinary/constants.js
HighSemantic Analysis LimitedWAProto/fix-import.js
HighKnown Malware Source Similaritylib/Utils/messages-media.js
HighSecret Patternlib/WABinary/constants.js
MediumNetwork
MediumShips Build HelperWAProto/GenerateStatics.sh
MediumOversized Source FileWAProto/index.js
MediumStructural Risk Force Deep Review
MediumGit Dependency
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptolib/Utils/validate-connection.js
LowFilesystem
Affected versions and remediation
This report applies to @lsqltmux-code/baileys@8.5.2.
See all versions of @lsqltmux-code/baileys for other recorded verdicts.
- Avoid installing @lsqltmux-code/baileys@8.5.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.